ROX-35006: Update Go 1.26 by janisz · Pull Request #20750 · stackrox/stackrox

janisz · 2026-05-21T11:19:44Z

Upgrade Go from 1.25.8 to 1.26.3 across the entire codebase, including all tool modules, operator tool modules, Konflux/Tekton builder images, and scanner/hack/quay.

Changes

Version bumps

go.mod: 1.25.8 → 1.26.3
All tools//go.mod and operator/tools//go.mod: aligned to 1.26.3
scanner/hack/quay/go.mod: 1.24 → 1.26.3 (removed stale toolchain go1.23.2)
Konflux builder image: openshift-golang-builder:rhel_9_golang_1.25 → rhel_9_golang_1.26 (brew buildID 4026077)
.golangci.yml: Go version 1.25 → 1.26

Fixes required for Go 1.26 compatibility

URL parser behavioral change (pkg/clientconn/client_test.go): Go 1.26 validates port syntax before checking URL escapes, changing the error priority. Updated test expectation from "invalid URL escape" to "invalid port after host".
IPv6 validation strictness (pkg/tlscheck/tlscheck.go): Go 1.26's url.Parse() now requires IPv6 addresses to be bracketed per RFC 2732. StackRox accepts unbracketed IPv6 including ambiguous IPv6:port formats. Fixed by routing IPv6 addresses through netutil.ParseEndpoint() instead of url.Parse(), and adding explicit whitespace validation.
govet printf format checks (pkg/env/integersetting.go): Changed %q to %v for []int — %q is for strings and Go 1.26's stricter govet catches the mismatch. (pkg/grpc/testutils.go): Added ... when forwarding variadic arguments to prevent treating a slice as a single argument.
Goroutine scheduling timing (central/processindicator/datastore/datastore_impl_test.go): Increased WaitWithTimeout from 3*prunePeriod (300ms) to 5*prunePeriod (500ms) on the prune path that includes a DB delete — the slowest path that's sensitive to Go 1.26's scheduling changes.
Linter configuration: Disabled the modernize linter (TODO ROX-35007) as it suggests Go 1.26 idioms across ~373 instances — deferred to a follow-up PR.

github-actions · 2026-05-21T11:34:21Z

🚀 Build Images Ready

Images are ready for commit ca6005f. To use with deploy scripts:

export MAIN_IMAGE_TAG=4.12.x-201-gca6005ff6c

janisz · 2026-05-27T07:55:48Z

/retest

coderabbitai · 2026-06-10T10:17:39Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 85b79307-ea51-4463-8f4c-95563f062867

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

✅ Review completed - (🔄 Check again to review again)

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch wip_bump_to_go_1.26

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Update openshift-golang-builder from rhel_9_golang_1.25 to rhel_9_golang_1.26 (brew buildID 4026077, Go 1.26.3). Partially generated by AI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Align all operator/tools/*/go.mod with the target Go version. Partially generated by AI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Was at go 1.24 with a stale toolchain directive. Partially generated by AI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

The guide duplicates information that belongs in commit messages and PR descriptions rather than a standalone document. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Five Konflux Dockerfiles still referenced rhel_9_golang_1.25. Updated to rhel_9_golang_1.26 (brew buildID 4026077) to match the builder already used in .konflux/ and .tekton/. Partially generated by AI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Enable the modernize linter (previously disabled with TODO ROX-35007) and add newexpr to the disabled checks list alongside existing ones. Partially generated by AI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Go 1.26 url.Parse rejects unbracketed IPv6 addresses. Instead of working around this, accept the stricter validation and require bracketed format (e.g. [2001:db8::1]:443). No real Docker registry endpoint uses unbracketed IPv6. Partially generated by AI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Co-authored-by: Tomasz Janiszewski <janiszt@gmail.com>

rhacs-bot · 2026-06-11T16:32:16Z

/retest

github-actions · 2026-06-15T10:53:26Z

/konflux-retest operator-bundle-on-push

rhacs-bot · 2026-06-15T12:52:24Z

/retest

github-actions · 2026-06-15T13:19:17Z

/konflux-retest operator-index-on-push

janisz · 2026-06-15T14:19:09Z

/konflux-retest operator-bundle-on-push

janisz · 2026-06-16T06:37:58Z

/konflux-retest operator-bundle-on-push

janisz · 2026-06-16T06:38:15Z

/konflux-retest operator-index-on-push

janisz · 2026-06-16T06:38:33Z

/konflux-retest create-custom-snapshot

Backport of #20750. Applies Go 1.26 compatibility fixes required after ROX-35288 bumped the compiler to 1.26.3: - URL parser: Go 1.26 validates port syntax before URL escapes - IPv6 validation: url.Parse now requires bracketed IPv6 per RFC 2732 - govet printf: %q → %v for []int (stricter format checking) - Goroutine scheduling: increased prune timeout for Go 1.26 scheduler - golangci: updated Go version to 1.26 - All tool go.mod files bumped to go 1.26.3 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Go 1.26 introduced the newexpr check in golangci-lint's modernize linter. The codebase on release-4.11 hasn't been updated for this rule, so disable it to match what was done on master in #20750. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

janisz requested review from a team as code owners May 21, 2026 11:19

openshift-ci Bot added the do-not-merge/work-in-progress label May 21, 2026

github-actions Bot added area/scanner area/ci ai-review coderabbit-review labels May 21, 2026

janisz force-pushed the wip_bump_to_go_1.26 branch from 87f1fa0 to 58db776 Compare May 21, 2026 11:24

github-actions Bot added the area/central label May 25, 2026

janisz force-pushed the wip_bump_to_go_1.26 branch 2 times, most recently from fc2686e to 1ec1982 Compare May 26, 2026 14:44

janisz changed the title ~~WIP: Go 1.26~~ ROX-34147: Update Go 1.26 May 29, 2026

openshift-ci Bot removed the do-not-merge/work-in-progress label May 29, 2026

janisz closed this May 29, 2026

janisz reopened this Jun 10, 2026

openshift-ci Bot added the needs-rebase label Jun 10, 2026

janisz force-pushed the wip_bump_to_go_1.26 branch from e15aafa to 1504624 Compare June 10, 2026 10:17

janisz requested review from a team and rhacs-bot as code owners June 10, 2026 10:17

github-actions Bot added area/operator konflux-build Run Konflux in PR. Push commit to trigger it. labels Jun 10, 2026

openshift-ci Bot removed the needs-rebase label Jun 10, 2026

janisz changed the title ~~ROX-34147: Update Go 1.26~~ ROX-35006: Update Go 1.26 Jun 10, 2026

janisz added the auto-retest PRs with this label will be automatically retested if prow checks fails label Jun 10, 2026

github-actions Bot added the area/helm label Jun 10, 2026

janisz and others added 10 commits June 11, 2026 17:14

chore: update Konflux builder to Go 1.26.3

eb81cce

Update openshift-golang-builder from rhel_9_golang_1.25 to rhel_9_golang_1.26 (brew buildID 4026077, Go 1.26.3). Partially generated by AI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chore: bump operator tool modules to Go 1.26.3

e79e72a

Align all operator/tools/*/go.mod with the target Go version. Partially generated by AI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chore: bump scanner/hack/quay to Go 1.26.3

aa14713

Was at go 1.24 with a stale toolchain directive. Partially generated by AI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chore: remove Go version upgrade guide

711f51d

The guide duplicates information that belongs in commit messages and PR descriptions rather than a standalone document. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chore: update modernize linter TODO to ROX-35007

5e7ece1

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

chore: enable modernize linter and disable newexpr check

abf821f

Enable the modernize linter (previously disabled with TODO ROX-35007) and add newexpr to the disabled checks list alongside existing ones. Partially generated by AI Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Apply suggestions from code review

2e903ce

Co-authored-by: Tomasz Janiszewski <janiszt@gmail.com>

Apply suggestion from @janisz

4beb9b6

janisz force-pushed the wip_bump_to_go_1.26 branch from acd2588 to 4beb9b6 Compare June 11, 2026 15:14

janisz added 2 commits June 12, 2026 12:23

Merge branch 'master' into wip_bump_to_go_1.26

9c2dbe7

Merge branch 'master' into wip_bump_to_go_1.26

a7fce48

janisz merged commit ca6005f into master Jun 16, 2026
122 of 123 checks passed

janisz deleted the wip_bump_to_go_1.26 branch June 16, 2026 08:50

janisz mentioned this pull request Jun 25, 2026

ROX-35006: backport Go 1.26 bump #21417

Merged

This was referenced Jun 30, 2026

ROX-35006: backport Go 1.26 bump #21483

Open

ROX-35006: backport Go 1.26 bump #21482

Draft

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

ROX-35006: Update Go 1.26#20750

ROX-35006: Update Go 1.26#20750
janisz merged 23 commits into
masterfrom
wip_bump_to_go_1.26

janisz commented May 21, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 21, 2026 •

edited

Loading

Uh oh!

janisz commented May 27, 2026

Uh oh!

coderabbitai Bot commented Jun 10, 2026 •

edited

Loading

Review skipped

Uh oh!

rhacs-bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 15, 2026

Uh oh!

rhacs-bot commented Jun 15, 2026

Uh oh!

github-actions Bot commented Jun 15, 2026

Uh oh!

janisz commented Jun 15, 2026

Uh oh!

janisz commented Jun 16, 2026

Uh oh!

janisz commented Jun 16, 2026

Uh oh!

janisz commented Jun 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Uh oh!

Conversation

janisz commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Version bumps

Fixes required for Go 1.26 compatibility

Uh oh!

github-actions Bot commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Build Images Ready

Uh oh!

janisz commented May 27, 2026

Uh oh!

coderabbitai Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

rhacs-bot commented Jun 11, 2026

Uh oh!

github-actions Bot commented Jun 15, 2026

Uh oh!

rhacs-bot commented Jun 15, 2026

Uh oh!

github-actions Bot commented Jun 15, 2026

Uh oh!

janisz commented Jun 15, 2026

Uh oh!

janisz commented Jun 16, 2026

Uh oh!

janisz commented Jun 16, 2026

Uh oh!

janisz commented Jun 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

janisz commented May 21, 2026 •

edited

Loading

github-actions Bot commented May 21, 2026 •

edited

Loading

coderabbitai Bot commented Jun 10, 2026 •

edited

Loading